An update for dovecot is now available for openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2722 Final 1.0 1.0 2026-06-24 Initial 2026-06-24 2026-06-24 openEuler SA Tool V1.0 2026-06-24 dovecot security update An update for dovecot is now available for openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1 Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. Security Fix(es): Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.(CVE-2026-33603) Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.(CVE-2026-40016) Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.(CVE-2026-40020) An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.(CVE-2026-42006) An update for dovecot is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium dovecot https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2722 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-33603 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40016 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40020 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-42006 https://nvd.nist.gov/vuln/detail/CVE-2026-33603 https://nvd.nist.gov/vuln/detail/CVE-2026-40016 https://nvd.nist.gov/vuln/detail/CVE-2026-40020 https://nvd.nist.gov/vuln/detail/CVE-2026-42006 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 dovecot-2.3.20-5.oe2403sp3.aarch64.rpm dovecot-debuginfo-2.3.20-5.oe2403sp3.aarch64.rpm dovecot-debugsource-2.3.20-5.oe2403sp3.aarch64.rpm dovecot-devel-2.3.20-5.oe2403sp3.aarch64.rpm dovecot-help-2.3.20-5.oe2403sp3.aarch64.rpm dovecot-2.3.15-8.oe2003sp4.aarch64.rpm dovecot-debuginfo-2.3.15-8.oe2003sp4.aarch64.rpm dovecot-debugsource-2.3.15-8.oe2003sp4.aarch64.rpm dovecot-devel-2.3.15-8.oe2003sp4.aarch64.rpm dovecot-help-2.3.15-8.oe2003sp4.aarch64.rpm dovecot-2.3.15-8.oe2203sp4.aarch64.rpm dovecot-debuginfo-2.3.15-8.oe2203sp4.aarch64.rpm dovecot-debugsource-2.3.15-8.oe2203sp4.aarch64.rpm dovecot-devel-2.3.15-8.oe2203sp4.aarch64.rpm dovecot-help-2.3.15-8.oe2203sp4.aarch64.rpm dovecot-2.3.20-5.oe2403sp1.aarch64.rpm dovecot-debuginfo-2.3.20-5.oe2403sp1.aarch64.rpm dovecot-debugsource-2.3.20-5.oe2403sp1.aarch64.rpm dovecot-devel-2.3.20-5.oe2403sp1.aarch64.rpm dovecot-help-2.3.20-5.oe2403sp1.aarch64.rpm dovecot-2.3.20-5.oe2403sp3.src.rpm dovecot-2.3.15-8.oe2003sp4.src.rpm dovecot-2.3.15-8.oe2203sp4.src.rpm dovecot-2.3.20-5.oe2403sp1.src.rpm dovecot-2.3.20-5.oe2403sp3.x86_64.rpm dovecot-debuginfo-2.3.20-5.oe2403sp3.x86_64.rpm dovecot-debugsource-2.3.20-5.oe2403sp3.x86_64.rpm dovecot-devel-2.3.20-5.oe2403sp3.x86_64.rpm dovecot-help-2.3.20-5.oe2403sp3.x86_64.rpm dovecot-2.3.15-8.oe2003sp4.x86_64.rpm dovecot-debuginfo-2.3.15-8.oe2003sp4.x86_64.rpm dovecot-debugsource-2.3.15-8.oe2003sp4.x86_64.rpm dovecot-devel-2.3.15-8.oe2003sp4.x86_64.rpm dovecot-help-2.3.15-8.oe2003sp4.x86_64.rpm dovecot-2.3.15-8.oe2203sp4.x86_64.rpm dovecot-debuginfo-2.3.15-8.oe2203sp4.x86_64.rpm dovecot-debugsource-2.3.15-8.oe2203sp4.x86_64.rpm dovecot-devel-2.3.15-8.oe2203sp4.x86_64.rpm dovecot-help-2.3.15-8.oe2203sp4.x86_64.rpm dovecot-2.3.20-5.oe2403sp1.x86_64.rpm dovecot-debuginfo-2.3.20-5.oe2403sp1.x86_64.rpm dovecot-debugsource-2.3.20-5.oe2403sp1.x86_64.rpm dovecot-devel-2.3.20-5.oe2403sp1.x86_64.rpm dovecot-help-2.3.20-5.oe2403sp1.x86_64.rpm Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known. 2026-06-24 CVE-2026-33603 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 Medium 5.3 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N dovecot security update 2026-06-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2722 Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known. 2026-06-24 CVE-2026-40016 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H dovecot security update 2026-06-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2722 Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known. 2026-06-24 CVE-2026-40020 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L dovecot security update 2026-06-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2722 An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known. 2026-06-24 CVE-2026-42006 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L dovecot security update 2026-06-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2722